Planning a UniFi network: gateways, VLANs and Wi-Fi for SMEs

1. Site assessment: understand first, select later

The site is assessed before any product is selected. This covers more than network outlets and the rack: internet handoff, floors, cable routes, wall and ceiling construction, existing fibre, power circuits, UPS capacity, third-party systems and possible expansion areas all matter. At the same time, build an endpoint inventory covering workstations, phones, printers, servers, NAS systems, tills, machinery, cameras, access readers, displays and mobile devices.

• Physical layer: quantity, category and test status of data cabling, patch panels, pathways, rack depth, cooling and power.
• Logical layer: existing subnets, DHCP and DNS services, static IP addresses, port forwards, VPNs, directory services and exceptional rules.
• Usage: concurrent users, peak periods, large data flows, real-time applications and devices limited to older Wi-Fi standards.
• Risk: which interruptions are tolerable, and which systems must continue through an internet, switch or power outage?
• Growth: additional staff, new rooms, more cameras, VoIP, a second internet circuit or another site.

2. Translate requirements into measurable quantities

Words such as fast, secure or resilient are too vague for a design. Every requirement needs a testable measure and a business context. A gigabit internet service, for example, says nothing about whether the firewall can sustain that rate with the intended security features enabled, or whether a narrow link between two switches will become the real bottleneck.

3. Size the gateway and firewall for the real workload

The gateway connects the internet, internal networks, VPNs and potentially multiple sites. Selecting it by nominal WAN speed alone is therefore insufficient. The decisive case is the most demanding planned workload with every feature that will actually be enabled. That includes firewalling, IDS/IPS, VPN encryption, inter-VLAN traffic, content filtering, multiple WAN links and concurrent connection counts.

• WAN now and later: contract, physical handoff, possible second provider and likely upgrade during the service life.
• Security profile: assess throughput with the intended inspection and filtering functions, not only under ideal conditions.
• VPN: record concurrent remote users and site tunnels, protocol choice and required data rate.
• Internal routes: traffic between VLANs can load the gateway unless it is handled by suitable Layer 3 components.
• Hosting model: UniFi Network commonly runs on a Cloud Gateway. Alternatively, the application can run on a Cloud Key, on the free self-hosted UniFi OS Server or on paid Official UniFi Hosting; routing is then handled by a UXG-series gateway without its own management software.

4. Switching and PoE: port count is only one budget

Four budgets are planned in parallel for every switch: port count, port speed, uplink capacity and PoE power. A switch can have enough empty sockets and still be unsuitable because individual ports lack the required PoE class, the total power budget is too small, or several busy access points and servers share a constrained uplink.

Document PoE port by port. For every access point, phone, camera and door controller, record the standard, maximum draw and intended switch port. Allow headroom for startup conditions, model changes and future expansion. Do not confuse passive PoE injectors with negotiated IEEE PoE, and use them only where device compatibility is unambiguous. Ubiquiti itself points out that its PoE adapters are passive, meaning they output voltage without any negotiation.

5. VLANs: design zones around function and risk

VLANs divide shared infrastructure into virtual networks, but their value comes from a clear rule matrix. A VLAN name does not provide protection on its own. The design must state which traffic between zones is allowed, logged or blocked. UniFi can map Wi-Fi networks and switch ports to fixed VLANs, with dynamic assignment via RADIUS available for more complex environments. Since version 9.0, the UniFi Network application manages the rules between networks in a zone-based firewall model. Note that new networks are initially placed in a built-in zone, typically “Internal”, and traffic within that zone is allowed by default. Separation only comes from dedicated zones or targeted policies.

If cameras are part of the project, recording, permissions and privacy deserve a separate workstream. The guide UniFi Protect and the GDPR: video surveillance at work covers those decisions.

6. Plan Wi-Fi as a radio network, not an accessory

Do not derive access point count from a generic square-metre figure. Walls, ceilings, shelving, machinery, neighbouring networks, client types and concurrent activity all change the outcome. Each radio cell must also fit the cabling and PoE plan. Vendor antenna patterns support predictive work, but they cannot replace measurements in the real building.

• Mark capacity zones: meeting rooms, training areas, waiting rooms and production may require more AP capacity than corridors and storage.
• Choose mounting positions from antenna behaviour and usage, not the most convenient empty wall or power outlet.
• Keep the SSID count small, and assign every SSID a purpose, VLAN and security requirement.
• Assess 2.4, 5 and 6 GHz separately because coverage, interference, channel supply and client support differ.
• After installation, validate coverage, interference, utilisation, throughput, latency and roaming with representative endpoints.

The full radio workflow, including material assessment, channel design, site survey and acceptance testing, is covered in Planning UniFi Wi-Fi: coverage, channels and roaming.

7. Add headroom and resilience deliberately

Headroom is capacity for expected change. Resilience is an alternative operating path when something fails. Both cost money and should follow the business impact of an outage. A second gateway achieves little if both internet circuits share the same building entry point, or if the only switch and UPS remain common points of failure.

• Allow free ports, PoE power, rack space, electrical capacity and uplink capacity for realistic expansion.
• For critical sites, assess two independent WAN paths, including route diversity, provider equipment and a tested automatic failover process.
• Configuration backups, documented recovery procedures and available spare units are often more economical than full duplication.
• Calculate UPS runtime for the whole system: gateway, switches, controller, modem and critical PoE consumers.
• Plan high-availability features such as Shadow Mode only after model support, cabling, test procedures and operational ownership are clear. Shadow Mode requires two identical rack-mount gateways (such as UDM Pro, UDM SE or UDM Pro Max) or two UXG Enterprise units.

8. Documentation and rollout are part of the architecture

Document the target state, dependencies and rollback path before cutover. A small network does not need a hundred-page operations manual, but without a port map, IP plan and access model, even the first device replacement becomes unnecessarily risky.

• Network diagram with devices, uplinks, cable identifiers, WAN handoffs and power supplies.
• VLAN, subnet, DHCP, DNS and SSID plan, including the firewall rule matrix.
• Switch port list with profile, speed, PoE mode and attached device.
• Administration model with personal accounts, roles, multi-factor authentication and securely retained recovery information.
• Acceptance record for internet, internal services, VPN, Wi-Fi, guest access, telephony and agreed failure scenarios.
• Change and rollback plan for migration, ideally in verifiable stages rather than switching everything over at once.

9. Operations: the network remains a living system

New endpoints, neighbouring networks, firmware and applications change the starting conditions after go-live. Configuration backups, staged updates, alerting, capacity monitoring and regular recovery tests therefore belong to operations. Treat VLAN and firewall changes as small projects: record the purpose, test, document and roll back if necessary.

For a broader view of the platform, read the article on UniFi’s suitability for businesses. If you want to compare its licensing and support model with an enterprise cloud platform, see UniFi vs. Cisco Meraki: licence costs over five years. I combine design, implementation and ongoing operations in my UniFi networks for businesses service.